SEMCMS CVE-2026-108814

Exploitation requires an authenticated low-privilege session (CVSS PR:L) with network access to the SEMCMS web application, after which a crafted request to the specific endpoint SEMCMS_Banner.php triggers the SQL injection. The key limiting factors are: (1) valid credentials or an existing authenticated session are needed - this is not an unauthenticated flaw; (2) the affected code path is the banner functionality in SEMCMS versions up to 5.0; and (3) no user interaction is required (UI:N) and complexity is low (AC:L), so once authenticated the attack is straightforward. No patch is available, so all deployments up to 5.0 remain exposed to authenticated users.

This is a LOW real-world priority despite being a remotely reachable SQL injection. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields only a 2.1 base score because PR:L requires an authenticated session and all impacts are rated Low rather than High - an unusual rating for SQLi, which often permits full database read/write; the Low impact ratings suggest VulDB judged the injection to expose or alter only limited data in the banner component. Signals are consistent rather than conflicting: E:P (Proof-of-Concept) matches the POC flag, and there is NO CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation. The attack is network-reachable and low-complexity, but the authentication requirement (PR:L) and the niche nature of the product sharply limit practical risk. Note the CWE-89 SQLi classification typically warrants higher confidentiality/integrity impact than the VC:L/VI:L assigned here - the low impact ratings should be verified, as a deeper injection could justify a higher score. Overall: a genuine but low-severity, researcher-disclosed flaw rather than an urgent threat.

An attacker who already holds low-privilege authenticated access to a SEMCMS instance sends a crafted request to SEMCMS_Banner.php containing malicious SQL in a parameter the application fails to sanitize, causing the backend database to execute attacker-controlled queries. A public proof-of-concept exploit exists (published on GitHub), lowering the skill barrier. Because the CVSS vector specifies PR:L, exploitation requires valid credentials or an existing session rather than being fully unauthenticated.